{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T18:04:26Z","timestamp":1783965866674,"version":"3.55.0"},"reference-count":34,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100013804","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100013804","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282024050"],"award-info":[{"award-number":["3282024050"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282024021"],"award-info":[{"award-number":["3282024021"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012226","name":"Fundamental Research Funds for the Central Universities","doi-asserted-by":"publisher","award":["3282025044"],"award-info":[{"award-number":["3282025044"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.cose.2026.104981","type":"journal-article","created":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T16:01:50Z","timestamp":1781107310000},"page":"104981","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Hiding the trees in the forest: Building network covert channels with hash-based covert carrier filtering"],"prefix":"10.1016","volume":"170","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-9444-9816","authenticated-orcid":false,"given":"Zexiao","family":"Zou","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiqiang","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-9851-5548","authenticated-orcid":false,"given":"Baoxu","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuyang","family":"Han","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"2","key":"10.1016\/j.cose.2026.104981_b1","doi-asserted-by":"crossref","first-page":"1655","DOI":"10.1007\/s10586-023-04035-5","article-title":"A deep learning approach for detecting covert timing channel attacks using sequential data","volume":"27","author":"Al-Eidi","year":"2023","journal-title":"Clust. Comput."},{"key":"10.1016\/j.cose.2026.104981_b2","series-title":"Covert channel using the IP timestamp option of an IPv4 packet","first-page":"48","author":"Alsaffar","year":"2016"},{"key":"10.1016\/j.cose.2026.104981_b3","series-title":"Proceedings of the 27th USENIX Conference on Security Symposium","first-page":"169","article-title":"Effective detection of multimedia protocol tunneling using machine learning","author":"Barradas","year":"2018"},{"key":"10.1016\/j.cose.2026.104981_b4","series-title":"Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security","first-page":"35","article-title":"Poking a hole in the wall: Efficient censorship-resistant internet communications by parasitizing on WebRTC","author":"Barradas","year":"2020"},{"key":"10.1016\/j.cose.2026.104981_b5","series-title":"Proceedings of the 14th Conference on USENIX Security Symposium - Volume 14","first-page":"13","article-title":"Mapping internet sensors with probe response attacks","author":"Bethencourt","year":"2005"},{"key":"10.1016\/j.cose.2026.104981_b6","series-title":"Proceedings of the 11th ACM Conference on Computer and Communications Security","first-page":"110","article-title":"Web tap: detecting covert web traffic","author":"Borders","year":"2004"},{"key":"10.1016\/j.cose.2026.104981_b7","doi-asserted-by":"crossref","DOI":"10.1016\/j.asoc.2019.105546","article-title":"Using hierarchical statistical analysis and deep neural networks to detect covert timing channels","volume":"82","author":"Darwish","year":"2019","journal-title":"Appl. Soft Comput."},{"key":"10.1016\/j.cose.2026.104981_b8","series-title":"Cloud Computing and Security","first-page":"346","article-title":"Network storage covert channel detection based on data joint analysis","author":"Fu","year":"2018"},{"issue":"6","key":"10.1016\/j.cose.2026.104981_b9","doi-asserted-by":"crossref","first-page":"1551","DOI":"10.1109\/TIFS.2018.2797953","article-title":"A covert queueing channel in FCFS schedulers","volume":"13","author":"Ghassami","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"issue":"2","key":"10.1016\/j.cose.2026.104981_b10","doi-asserted-by":"crossref","first-page":"292","DOI":"10.1109\/TSE.1987.233153","article-title":"Covert channels in lan\u2019s","volume":"SE-13","author":"Girling","year":"1987","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.cose.2026.104981_b11","series-title":"Proceedings of the First International Workshop on Information Hiding","first-page":"23","article-title":"Hiding data in the OSI network model","author":"Handel","year":"1996"},{"key":"10.1016\/j.cose.2026.104981_b12","series-title":"Proceedings of the 12th International Conference on Availability, Reliability and Security","article-title":"Are network covert timing channels statistical anomalies?","author":"Iglesias","year":"2017"},{"key":"10.1016\/j.cose.2026.104981_b13","series-title":"2022 IEEE Symposium on Security and Privacy","first-page":"1971","article-title":"Security foundations for application-based covert communication channels","author":"Iv","year":"2022"},{"issue":"2","key":"10.1016\/j.cose.2026.104981_b14","doi-asserted-by":"crossref","DOI":"10.3390\/app11020731","article-title":"Reversible and plausibly deniable covert channels in one-time passwords based on hash chains","volume":"11","author":"Keller","year":"2021","journal-title":"Appl. Sci."},{"issue":"10","key":"10.1016\/j.cose.2026.104981_b15","doi-asserted-by":"crossref","first-page":"613","DOI":"10.1145\/362375.362389","article-title":"A note on the confinement problem","volume":"16","author":"Lampson","year":"1973","journal-title":"Commun. ACM"},{"issue":"5","key":"10.1016\/j.cose.2026.104981_b16","doi-asserted-by":"crossref","first-page":"192","DOI":"10.1145\/1067629.806537","article-title":"A comment on the confinement problem","volume":"9","author":"Lipner","year":"1975","journal-title":"SIGOPS Oper. Syst. Rev."},{"key":"10.1016\/j.cose.2026.104981_b17","series-title":"Journal of Physics Conference Series","article-title":"A Robust and Flexible Covert Channel in LTE-A System","volume":"vol. 1087","author":"Liu","year":"2018"},{"key":"10.1016\/j.cose.2026.104981_b18","article-title":"Covert channels in internet protocols: A survey","volume":"vol. 2005","author":"Llamas","year":"2005"},{"key":"10.1016\/j.cose.2026.104981_b19","series-title":"ABC-channel: An advanced blockchain-based covert channel","author":"Ma","year":"2024"},{"key":"10.1016\/j.cose.2026.104981_b20","series-title":"Proceedings of the 13th International Conference on Availability, Reliability and Security","article-title":"Towards deriving insights into data hiding methods using pattern-based approach","author":"Mazurczyk","year":"2018"},{"issue":"3","key":"10.1016\/j.cose.2026.104981_b21","doi-asserted-by":"crossref","DOI":"10.3390\/cryptography2030018","article-title":"Provably secure covert communication on blockchain","volume":"2","author":"Partala","year":"2018","journal-title":"Cryptography"},{"key":"10.1016\/j.cose.2026.104981_b22","series-title":"30th USENIX Security Symposium (USENIX Security 21)","first-page":"3399","article-title":"Balboa: Bobbing and weaving around network censorship","author":"Rosen","year":"2021"},{"key":"10.1016\/j.cose.2026.104981_b23","series-title":"Proceedings of the 1977 Annual Conference","first-page":"404","article-title":"Program confinement in KVM\/370","author":"Schaefer","year":"1977"},{"issue":"2","key":"10.1016\/j.cose.2026.104981_b24","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1109\/TDSC.2015.2423680","article-title":"A support vector machine-based framework for detection of covert timing channels","volume":"13","author":"Shrestha","year":"2016","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.cose.2026.104981_b25","series-title":"Advances in Cryptology: Proceedings of CRYPTO \u201983","first-page":"51","article-title":"The prisoners\u2019 problem and the subliminal channel","author":"Simmons","year":"1983"},{"key":"10.1016\/j.cose.2026.104981_b26","series-title":"Information and Communications Security","first-page":"313","article-title":"A study on the covert channel detection of TCP\/IP header using support vector machine","author":"Sohn","year":"2003"},{"key":"10.1016\/j.cose.2026.104981_b27","series-title":"IEEE INFOCOM 2016 - the 35th Annual IEEE International Conference on Computer Communications","first-page":"1","article-title":"Sneak-peek: High speed covert channels in data center networks","author":"Tahir","year":"2016"},{"key":"10.1016\/j.cose.2026.104981_b28","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2023.109843","article-title":"A covert channel over blockchain based on label tree without long waiting times","volume":"232","author":"Wang","year":"2023","journal-title":"Comput. Netw."},{"issue":"1","key":"10.1016\/j.cose.2026.104981_b29","doi-asserted-by":"crossref","first-page":"614","DOI":"10.1109\/TDSC.2024.3410679","article-title":"DYST (did you see that?): An amplified covert channel that points to previously seen data","volume":"22","author":"Wendzel","year":"2025","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"issue":"3","key":"10.1016\/j.cose.2026.104981_b30","doi-asserted-by":"crossref","DOI":"10.1145\/2684195","article-title":"Pattern-based survey and categorization of network covert channel techniques","volume":"47","author":"Wendzel","year":"2015","journal-title":"ACM Comput. Surv."},{"issue":"8","key":"10.1016\/j.cose.2026.104981_b31","first-page":"2470","article-title":"Survey on key issues in networks covert channel","volume":"30","author":"Yan-Feng","year":"2019","journal-title":"J. Softw."},{"key":"10.1016\/j.cose.2026.104981_b32","series-title":"2007 15th IEEE International Conference on Networks","first-page":"42","article-title":"An empirical evaluation of IP time to live covert channels","author":"Zander","year":"2007"},{"key":"10.1016\/j.cose.2026.104981_b33","doi-asserted-by":"crossref","first-page":"66","DOI":"10.1016\/j.ins.2018.03.007","article-title":"Building covert timing channels by packet rearrangement over mobile networks","volume":"445\u2013446","author":"Zhang","year":"2018","journal-title":"Inform. Sci."},{"key":"10.1016\/j.cose.2026.104981_b34","series-title":"Information Hiding","first-page":"344","article-title":"Modeling the security of steganographic systems","author":"Z\u00f6llner","year":"1998"}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826001574?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826001574?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T17:13:14Z","timestamp":1783962794000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826001574"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":34,"alternative-id":["S0167404826001574"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.104981","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Hiding the trees in the forest: Building network covert channels with hash-based covert carrier filtering","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.104981","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"104981"}}